Vulnerability Details CVE-2017-9442
BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary code by uploading a crafted package containing a PHP web shell, related to extraction of a ZIP archive to filename patterns such as cache/package/xxx/yyy.php. This issue exists in core\admin\modules\developer\extensions\install\unpack.php and core\admin\modules\developer\packages\install\unpack.php. NOTE: the vendor states "You must implicitly trust any package or extension you install as they all have the ability to write PHP files.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.023
EPSS Ranking 83.7%
CVSS Severity
CVSS v3 Score 8.8
CVSS v2 Score 6.5
References
Products affected by CVE-2017-9442
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.0
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.0.1
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.0.10
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.0.11
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.0.12
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.0.13
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.0.2
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.0.3
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.0.4
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.0.5
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.0.6
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.0.7
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.0.8
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.0.9
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.1
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.1.1
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.1.10
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.1.12
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.1.13
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.1.14
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.1.15
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.1.16
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.1.17
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.1.18
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.1.2
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.1.3
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.1.4
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.1.5
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.1.6
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.1.8
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.1.9
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.2
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.2.1
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.2.10
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.2.11
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.2.12
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.2.13
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.2.14
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.2.15
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.2.16
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.2.17
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.2.18
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.2.2
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.2.3
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.2.4
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.2.5
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.2.6
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.2.7
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.2.8
-
cpe:2.3:a:bigtreecms:bigtree_cms:4.2.9